The club confirmed one of the cases is suspected to be the Omicron variant that sparked travel restrictions on flights from South Africa to the UK.
A Cardiff statement said: "PCR tests undertaken last night have returned two positive results."
However, Welsh rivals Scarlets are on the flight both teams were due to take.
Irish side Munster also have a positive Covid case and, like Cardiff, must remain in isolation in South Africa.
Cardiff's playing and coaching staff have "returned to their hotel to isolate".
Their statement added: "Cardiff Rugby continue to work with the South African Rugby Union, the Welsh Rugby Union and public health authorities both at home and abroad to decide the next course of action.
"The club are also continuing to work with all relevant authorities to secure the travelling party's return to Wales when safe and appropriate.
"Everybody concerned in this highly challenging situation would like to thank their families, friends, colleagues and the wider rugby family for their many messages of concern and well wishes.
"No further comments will be made at this time."
South African government guidelines say individuals who test positive for Covid must isolate for 14 days from the day of developing symptoms, not the day of the positive result.
There has been no confirmation that either or both of Cardiff's cases are symptomatic.
Cardiff were in South Africa to play in the United Rugby Championship, but all the tournament games in the country over this and next weekend have been called off.
In the meantime, Cardiff and Scarlets were attempting to return home as soon as possible.
Cardiff say they were booked onto a charter flight on Sunday afternoon, but their departure has been delayed for an as-yet unspecified duration.
Scarlets stated "the travelling squad and staff are currently flying from South Africa to Europe" and director and former chairman Ron Jones urged the authorities "to get our people home to Wales and safe".
The west Wales side's chairman Simon Muderack later told Scrum V the intended plan involved landing in Dublin followed by a transfer to an "isolation" hotel in Belfast.
Muderack also said all the players and staff had twice tested negative for Covid in the previous 48 hours.
Cardiff's plight puts a question mark over their ability to host French side Toulouse in the Heineken Champions Cup on Saturday, 11 December.
Current UK rules state anyone arriving from six recently red-listed countries in Africa must isolate in a hotel for 10 days.
South Africa is one of those six nations after the Omicron Covid-19 variant was detected there.
Scarlets are scheduled to go to English side Bristol on Saturday, 11 December, also in the Heineken Champions Cup.
UK Health Secretary Sajid Javid said from 12:00 GMT on Friday, six countries would be on the red list for travel into England. That has now expanded to 10 countries, which are South Africa, Namibia, Zimbabwe, Botswana, Lesotho, Eswatini, Angola, Mozambique, Malawi and Zambia.
The Welsh government has since adopted those travel rules
which state any British resident arriving from the 10 countries after 04:00 GMT on Sunday must quarantine in a hotel.
Those who returned before that deadline have been asked to isolate at home for 10 days.